Windows Sysprep Execution Targeting AppData Directory

Alerts when sysprep.exe runs with an AppData directory present in the command line on Windows.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-06-22
Updated: 2026-07-30

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where sysprep.exe is launched with a command line containing an AppData path. Attackers may use sysprep to blend execution into legitimate Windows workflows while operating on user-controlled directories like AppData. Detection relies on Windows process creation telemetry capturing the process image name and command-line arguments.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

OpenClaw Loader Execution via LuaJIT Interpreter Running Text Payload (via process_creation)

Malicious Git Config sshCommand Modification for Code Execution on Linux

Suspicious React2Shell Cryptominer Masquerade and Crond Persistence on Linux

Suspicious Reconnaissance Commands Spawned by Node.js Runtime on Linux

Suspicious Amazon Q Developer CLI Invocation With Trust All Tools Flag

Suspicious AI CLI Invoked With Permission Bypass Flags (s1ngularity Aftermath)

Suspicious Selenium Grid Binary Location RCE via Python Interpreter on Linux

Suspicious ECS ExecuteCommand Lateral Movement via SSM in AWS CloudTrail (via cloudtrail)

Possible Ivanti EPMM Unauthenticated RCE via featureusage Expression Language Injection (via webserver)

Windows Sysprep Execution Targeting AppData Directory

Pivot detection · T1059 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-sysprep-execution-targeting-appdata-directory-d5b9ae7a

title: Windows Sysprep Execution Targeting AppData Directory
id: f3c7747d-0ca0-46a0-b401-3e806d835c4b
status: test
description: This rule flags process creation events where sysprep.exe is launched with a command line containing an AppData path. Attackers may use sysprep to blend execution into legitimate Windows workflows while operating on user-controlled directories like AppData. Detection relies on Windows process creation telemetry capturing the process image name and command-line arguments.
references:
  - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
  - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-06-22
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \sysprep.exe
    CommandLine|contains: \AppData\
  condition: selection
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: medium
license: DRL-1.1
related:
  - id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL